MD 5 collisions and the impact on computer forensics Eric
نویسندگان
چکیده
In August 2004 at the annual cryptography conference in Santa Barbara, California a group of cryptographers, Xianyan Wang, Dengguo Feng, Xuejia Lai, Hongbo Yu, made the announcement that they had successfully generated two files with different contents that had the same MD5 hash. This paper reviews the announcement and discusses the impact this discovery may have on the use of MD5 hash functions for evidence authentication in the field of computer forensics. 2005 Elsevier Ltd. All rights reserved. Hash functions are one of the basic building blocks of modern cryptography. In cryptography hash functions are used for everything from password verification to digital signatures. A hash function has three fundamental properties: A hash function must be able to easily convert digital information (i.e. a message) into a fixed length hash value. It must be computationally infeasible to derive any information about the input message from just the hash. It must be computationally infeasible to find two files that have the same hash. Hash(Message 1)Z Hash(Message 2). E-mail address: [email protected] 1742-2876/$ see front matter 2005 Elsevier Ltd. All rights rese doi:10.1016/j.diin.2005.01.004 In computer forensics hash functions are importantbecause theyprovideameansof identifyingand classifying electronic evidence. Because hash functionsplayacritical role inevidenceauthentication it is critical a judge or jury can trust the hash values that uniquely identify electronic evidence. The third property of a hash function states that it must be computationally infeasible to find two files to have the same hash. The research published by Wang, Feng, Lai and Yu demonstrated that MD5 fails this third requirement since two different messages have been generated that have the same hash. This situation is called a collision.
منابع مشابه
The Impact of MD5 File Hash Collisions On Digital Forensic Imaging
The Message Digest 5 (MD5) hash is commonly used as for integrity verification in the forensic imaging process. The ability to force MD5 hash collisions has been a reality for more than a decade, although there is a general consensus that hash collisions are of minimal impact to the practice of computer forensics. This paper describes an experiment to determine the results of imaging two disks ...
متن کاملAvoiding Cyber-attacks to DMZ and Capturing Forensics from Intruders Using Honeypots
Nowadays, honeypots are widely used to divert attackers from the original target and keep them busy within a decoy environment. DeMilitarized Zone (DMZ) is an important zone for network administrators, because many of the services to the public network is provided at this zone. Many of the security tools such as firewalls, intrusion detection systems and several other secu...
متن کاملMolecular Dynamics Simulation of Al Energetic Nano Cluster Impact (ECI) onto the Surface
On the atomic scale, Molecular Dynamic (MD) Simulation of Nano Al cluster impact on Al (100) substrate surface has been carried out for energies of 1-20 eV/atom to understand quantitatively the interaction mechanisms between the cluster atoms and the substrate atoms. The many body Embedded Atom Method (EAM) was used in this simulation. We investigated the maximum substrate temperature Tmax and...
متن کاملGuessing in Multiple Choice Questions: Challenges and Strategies
Introduction: Guessing is one of the most challenging issues in multiple choice questions. Several strategies, such as negative scoring, have been suggested for preventing students from choosing the right answer just by chance. However, there is no general agreement on using such strategies. The aim of this study was to review the scoring methods which are used for reducing guessing, and evalua...
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
عنوان ژورنال:
دوره شماره
صفحات -
تاریخ انتشار 2005